Nuked Klan Arbitrary .SWF File Cookie Theft Vulnerability

Bugtraq ID:	21850
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 02 2007 12:00AM
Updated:	Jan 04 2007 08:37PM
Credit:	NeoSSJ & Kad' reported this vulnerability.
Vulnerable:	Nuked-Klan Nuked-Klan 1.7 Nuked-Klan Nuked-Klan 1.5 SP2 Nuked-Klan Nuked-Klan 1.5 Nuked-Klan Nuked-Klan 1.4 Nuked-Klan Nuked-Klan 1.3 beta Nuked-Klan Nuked-Klan 1.3 Nuked-Klan Nuked-Klan 1.2 beta Nuked-Klan Nuked-Klan 1.2
Not Vulnerable:

Nuked Klan Arbitrary .SWF File Cookie Theft Vulnerability

Nuked Klan is prone to a cookie-theft vulnerability.

An attacker may leverage this issue to steal cookie-based authentication credentials and potentially carry out other attacks.

Nuked Klan 1.7 and prior versions are vulnerable to this issue.

Nuked Klan Arbitrary .SWF File Cookie Theft Vulnerability

An attacker can trigger these vulnerabilities by enticing a victim user to follow a malicious URI.

Nuked Klan Arbitrary .SWF File Cookie Theft Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Nuked Klan Arbitrary .SWF File Cookie Theft Vulnerability

References:

• Nuked-Klan Home Page (Nuked-Klan)
  
• Nuked Klan <= 1.7 Remote Cookie Disclosure Exploit ([email protected])